Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Prasyarat
Sebelum menggunakan fungsi , pastikan untuk melengkapi prasyarat berikut:
-
Masuk ke domain SageMaker AI dengan akses Studio. Jika Anda tidak memiliki izin untuk menetapkan Studio sebagai pengalaman default untuk domain Anda, hubungi administrator Anda. Untuk informasi selengkapnya, lihat ik h SageMaker tisar domain Amazon AI.
-
Perbarui AWS CLI dengan mengikuti langkah-langkah di Meng instal AWS CLI Versi saat ini.
-
Dari mesin lokal Anda, jalankan
aws configuredan berikan AWS kredensibilitas Anda. Untuk informasi tentang AWS kredenSIAL, lihat Mem ahami dan mendapatkan AWS kredensi Anda.
Izin IAM yang diperlukan
SageMaker Kustomisasi model AI memerlukan penambahan izin yang sesuai ke peran eksekusi SageMaker AI Anda.
Menyiapkan izin melalui konsol
Jika Anda membuat domain SageMaker AI melalui konsol, izin untuk penyesuaian model ditangani secara otomatis tergantung pada metode penyiapan Anda:
-
Pengaturan cepat - Izin kustomisasi model disertakan secara default. Tidak diperlukan konfigurasi tambahan.
-
Pengaturan kustom — Pilih aktivitas ML kustomisasi Model saat mengonfigurasi peran eksekusi Anda. Untuk informasi selengkapnya tentang aktivitas ML dan izin yang diberikan, lihat Meng onfigurasi aktivitas ML untuk peran IAM.
Menyiapkan izin secara manual
Jika Anda mengatur domain melalui AWS CLI, SDK, atau CloudFormation, atau jika Anda perlu menambahkan izin penyesuaian model ke peran eksekusi yang ada, gunakan salah satu opsi berikut.
Opsi 1 (Direkomendasikan): Lampirkan kebijakan ter AWS kelola
Lampirkan kebijakan AmazonSageMakerModelCustomizationCoreAccess terkelola ke peran eksekusi SageMaker AI Anda. Kebijakan ini mencakup semua izin yang diperlukan untuk penyesuaian model dasar, termasuk pelatihan tanpa server, fungsi hadiah khusus RL, evaluasi model, dan penerapan ke titik akhir SageMaker AI atau Bedrock. Untuk informasi tentang melampirkan kebijakan, lihat Menambahkan dan menghapus izin identitas IAM di Panduan Pengguna Manajemen AWS Identitas dan Akses.
Opsi 2: Buat kebijakan sebaris
Jika Anda lebih suka mengelola izin secara manual, buat kebijakan sebaris dengan JSON berikut dan lampirkan ke peran eksekusi Anda:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerPublicHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListHubContents" ], "Resource": [ "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" ] }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ImportHubContent", "sagemaker:ListHubs", "sagemaker:ListHubContents", "sagemaker:ListHubContentVersions", "sagemaker:DescribeHubContent", "sagemaker:DeleteHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "JumpStartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::jumpstart*" ] }, { "Sid": "SageMakerTrainingJob", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:ListTrainingJobs", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMLFlow", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowApp", "sagemaker:DescribeMlflowApp", "sagemaker:CreatePresignedMlflowAppUrl", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetLoggedModel", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:UpdateRun" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BYODataSetS3Access", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackage", "Effect": "Allow", "Action": [ "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:UpdateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:DescribeModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerLineage", "Effect": "Allow", "Action": [ "sagemaker:CreateAction", "sagemaker:CreateArtifact", "sagemaker:CreateContext", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:QueryLineage", "sagemaker:AddAssociation", "sagemaker:UpdateArtifact" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerPipelines", "Effect": "Allow", "Action": [ "sagemaker:CreatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:UpdatePipeline", "sagemaker:StartPipelineExecution" ], "Resource": [ "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInference", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateInferenceComponent", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteEndpoint", "sagemaker:InvokeEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceAutoscaling", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "arn:aws:application-autoscaling:*:*:scalable-target/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceEcrReadAccess", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListActions", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListEndpoints", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowApps", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListWorkforces", "sagemaker:Search" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerTagsPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:action/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerJobAdvancedSettings", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "ec2:DescribeVpcs", "servicequotas:ListServiceQuotas" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogReadAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "arn:aws:logs:*:*:log-group::log-stream:" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogWriteAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaListFunctions", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissionsForRewardFunction", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:InvokeFunction", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaLayerForAWSSDK", "Effect": "Allow", "Action": [ "lambda:GetLayerVersion" ], "Resource": [ "arn:aws:lambda:*:336392948345:layer:AWSSDK*" ] }, { "Sid": "BedrockCustomModelAndEvaluation", "Effect": "Allow", "Action": [ "bedrock:CreateCustomModel", "bedrock:CreateEvaluationJob", "bedrock:GetCustomModel", "bedrock:GetModelImportJob", "bedrock:GetImportedModel", "bedrock:GetEvaluationJob", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:evaluation-job/*", "arn:aws:bedrock:*:*:imported-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:model-import-job/*", "arn:aws:bedrock:*:*:foundation-model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockModelImportAndList", "Effect": "Allow", "Action": [ "bedrock:CreateModelImportJob", "bedrock:ListProvisionedModelThroughputs", "bedrock:ListCustomModelDeployments", "bedrock:ListCustomModels", "bedrock:ListModelImportJobs" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockFoundationModelOperations", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModelAvailability", "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "PassRoleForSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/*SageMaker*", "arn:aws:iam::*:role/service-role/*Sagemaker*", "arn:aws:iam::*:role/service-role/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "job.sagemaker.amazonaws.com" ] }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:sagemaker:*:*:*" } } }, { "Sid": "PassRoleForAWSLambda", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/SageMakerForLambda*", "arn:aws:iam::*:role/service-role/SageMakerForLambda*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:lambda:*:*:function:*" } } }, { "Sid": "PassRoleForBedrock", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/SageMakerForBedrock*", "arn:aws:iam::*:role/service-role/SageMakerForBedrock*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } } ] }
Peran untuk Lambda dan Bedrock
Selain izin pada peran eksekusi SageMaker AI Anda, kustomisasi model memerlukan peran untuk dua layanan lainnya:
-
Lambda - menjalankan fungsi hadiah khusus selama pelatihan RL-based
-
Bedrock - membaca artefak model dari S3 saat mengimpor model khusus untuk penerapan
Jika sebelumnya Anda mengonfigurasi peran eksekusi Anda (pendekatan lama)
Jika sebelumnya Anda mengikuti dokumentasi ini dan memperbarui kebijakan kepercayaan peran eksekusi SageMaker AI Anda untuk menyertakan lambda.amazonaws.com dan bedrock.amazonaws.com sebagai prinsipal layanan tepercaya, konfigurasi yang ada akan terus berfungsi. Tidak ada perubahan yang diperlukan.
Untuk menggunakan pendekatan ini, kebijakan kepercayaan peran eksekusi Anda harus menyertakan prinsip-prinsip layanan berikut:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
catatan
Pendekatan ini kurang aman karena Lambda dan Bedrock dapat mengambil peran eksekusi Anda dan mewarisi semua izinnya — bukan hanya yang dibutuhkan setiap layanan.
Buat peran terpisah (disarankan)
Untuk meningkatkan keamanan, buat dua peran IAM terpisah dengan cakupan — satu untuk Lambda dan satu untuk Bedrock — daripada menambahkan prinsip-prinsip layanan ini ke peran eksekusi AI Anda. SageMaker Setiap peran hanya mempercayai layanannya masing-masing dan hanya berisi izin minimum yang diperlukan layanan.
Jika Anda mengatur domain melalui pengaturan cepat konsol SageMaker AI, peran ini dibuat secara otomatis. Jika Anda mengatur domain Anda melalui metode lain, buat secara manual menggunakan langkah-langkah berikut.
Peran Lambda
Peran ini memungkinkan Lambda untuk menjalankan fungsi hadiah khusus selama penyesuaian RL-based model.
Konvensi penamaan: SageMakerForLambda-{domain-id}
-
Buat peran IAM dengan kebijakan kepercayaan berikut. Ganti
<ACCOUNT_ID>dengan ID AWS akun 12 digit Anda.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<ACCOUNT_ID>" }, "ArnLike": { "aws:SourceArn": "arn:aws:lambda:*:<ACCOUNT_ID>:function:*" } } } ] } -
Lampirkan
AWSLambdaBasicExecutionRoleAWS kebijakan terkelola ke peran. Ini memberikan izin yang diperlukan untuk menulis log ke CloudWatch.
catatan
Peran ini tidak memerlukan izin SageMaker AI atau Bedrock. Ketentuan aws:SourceAccount dan aws:SourceArn ketentuan membatasi asumsi peran hanya untuk fungsi Lambda di akun Anda, melindungi dari serangan wakil yang membingungkan.
Peran batuan dasar
Peran ini memungkinkan Bedrock membaca artefak model dari bucket SageMaker AI-managed S3 Anda saat mengimpor model khusus.
Konvensi penamaan: SageMakerForBedrock-{domain-id}
-
Buat peran IAM dengan kebijakan kepercayaan berikut. Ganti
<ACCOUNT_ID>dengan ID AWS akun 12 digit Anda.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<ACCOUNT_ID>" }, "ArnLike": { "aws:SourceArn": "arn:aws:bedrock:*:<ACCOUNT_ID>:*" } } } ] } -
Lampirkan kebijakan sebaris berikut ke peran:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerBucketReadAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSSLRequestsOnly", "Action": "s3:*", "Effect": "Deny", "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] }
catatan
Peran ini tidak memerlukan izin SageMaker AI, Lambda, atau API Bedrock. Ini hanya menyediakan Bedrock dengan akses baca ke artefak model di bucket SageMaker AI-managed S3 Anda.
